Investigation identifies gaps in vendor oversight
A data-breach notification on April 3 prompted the investigation into the surgical patient records system at United Christian Hospital, MLex reported. The regulator found shortcomings in the authority's oversight of vendor access, an absence of role-based access controls and insufficient security audits.
The Office of the Privacy Commissioner for Personal Data (PCPD) completed the investigation and released its report on October 30, 2026. Its enforcement notice requires the authority to strengthen vendor monitoring, restrict data exports and carry out regular security assessments.
The affected system was supplied by a vendor and used for surgical documentation, Duncan Chiu, chairman of the authority's Information Technology Services Committee, told RTHK. He said it was a subordinate system, separate from the authority's Clinical Management System, which contains comprehensive patient medical records and was not affected. According to Chiu, the leaked information consisted of limited personal details and did not include contact information such as addresses or phone numbers.
Access restrictions and security checks
In its October 30 response, published by the Hong Kong Government, the Hospital Authority accepted the investigation's findings and recommendations and pledged appropriate follow-up action.
The authority said its Kowloon East Cluster had introduced safeguards following the incident. Authorized Hospital Authority IT staff must accompany contractor personnel whenever they access systems on-site. Records must identify those personnel and document the purpose and time of access, along with the equipment involved.
The cluster also conducts regular data-access audits and requires contractors to provide periodic audit reports. Access permissions are assigned according to roles and functions, with exports permitted only in specifically approved circumstances. The affected systems are subject to regular independent security risk assessments and audits.
Chief Information Officer Clara Cheung told RTHK that the authority had also tightened access for all vendors to vendor-supplied systems as an immediate response. Other than for emergency operational needs, access requires approval and monitoring. She said the authority would consider suspending the contractor involved from applying for future Hospital Authority tenders.
Contractor employee arrested
The authority characterized the breach as an isolated incident involving control of a contractor's data access during maintenance of a peripheral clinical system.
It said police had arrested a contractor employee on suspicion of accessing a computer with dishonest intent. The criminal investigation remained ongoing as of October 30, 2026, and the authority declined further comment on the incident while that investigation continued.
Earlier enforcement over discarded patient records
The authority previously received an enforcement notice over patient data in October 2013. In that case, the PCPD found that improper disposal of hospital waste containing patient records violated Data Protection Principle 4.
According to the regulator's October 24, 2013, statement, the incidents involved a used printer ribbon from Pok Oi Hospital containing data on 16 patients and shredded medical appointment slips from Our Lady of Maryknoll Hospital.
